Limit Bind, Impersonate, and Escalate Permissions (CIS 5.1.8)

​

Impact & Risk Analysis

• Severity: High
• CIS Benchmark: CIS 5.1.8
• Impact: Privilege Escalation to Cluster Admin. These three permissions are “meta-permissions” that allow a user to bypass their assigned restrictions:
  • Impersonate: Allows a user to act as another user (e.g., system:admin) or group (system:masters), instantly inheriting their rights.
  • Bind: Allows a user to create a RoleBinding to a Role that has more permissions than the user currently holds (effectively gifting themselves admin rights).
  • Escalate: Allows a user to edit a Role to add permissions that they do not possess themselves.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable Role
# Intended to manage users, but grants dangerous escalation rights
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: user-manager
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["users", "groups", "serviceaccounts"]
  # VULNERABLE: 'impersonate' allows becoming any user
  verbs: ["impersonate"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "clusterroles"]
  # VULNERABLE: 'bind' and 'escalate' allow granting extra rights
  verbs: ["bind", "escalate"]

​

Secure Example

# Secure Role
# Allows managing RoleBindings but restricted to safe operations
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: safe-user-manager
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings"]
  # SECURE: 'create' and 'update' are allowed, but without 'bind' or 'escalate',
  # Kubernetes prevents the user from binding to a role higher than their own.
  verbs: ["create", "get", "list", "update"]

​

Audit Procedure

# Search for dangerous verbs in all Roles and ClusterRoles
kubectl get roles,clusterroles --all-namespaces -o yaml | grep -E "bind|impersonate|escalate"

• Analyze: Identify any non-system role containing these verbs.
• Fail: If a standard user role contains impersonate, bind, or escalate.

​

Remediation

1. Impersonate: Should only be held by system components (like ingress controllers) that need to act on behalf of users.
2. Bind/Escalate: Should generally be restricted to the cluster-admin role. If you need delegated administration, rely on the built-in Kubernetes prevention mechanism (which blocks binding to higher roles) rather than explicitly granting the bind or escalate verb override.